U.S. patent number 7,949,875 [Application Number 11/683,663] was granted by the patent office on 2011-05-24 for message authentication.
This patent grant is currently assigned to Sony Deutschland GmbH. Invention is credited to Niels Mache.
United States Patent |
7,949,875 |
Mache |
May 24, 2011 |
Message authentication
Abstract
For the authentication of messages communicated in a distributed
system from an originator to a destination a keyed-hashing
technique is used according to which data to be authenticated is
concatenated with a private (secret) key and then processed to the
cryptographic hash function. The data are transmitted together with
the digest of the hash function from the originator to the
destination. The data comprises temporal validity information
representing the temporal validity of the data. For example the
setup key of a communication is therefore only valid within a given
time interval that is dynamically defined by the communication
originator. After the time interval is exceeded the setup key is
invalid and cannot be reused again.
Inventors: |
Mache; Niels (Stuttgart,
DE) |
Assignee: |
Sony Deutschland GmbH (Cologne,
DE)
|
Family
ID: |
8239524 |
Appl.
No.: |
11/683,663 |
Filed: |
March 8, 2007 |
Prior Publication Data
|
|
|
|
Document
Identifier |
Publication Date |
|
US 20070162757 A1 |
Jul 12, 2007 |
|
Related U.S. Patent Documents
|
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
Issue Date |
|
|
09728800 |
Dec 1, 2000 |
7213149 |
|
|
|
Foreign Application Priority Data
|
|
|
|
|
Dec 2, 1999 [EP] |
|
|
99124150 |
|
Current U.S.
Class: |
713/170; 713/171;
380/283; 380/284; 380/281; 380/259; 713/178 |
Current CPC
Class: |
H04L
9/3242 (20130101); H04L 9/3297 (20130101); H04L
63/126 (20130101); H04L 63/061 (20130101); H04L
63/0442 (20130101) |
Current International
Class: |
H04L
9/00 (20060101) |
References Cited
[Referenced By]
U.S. Patent Documents
Foreign Patent Documents
|
|
|
|
|
|
|
0 874 300 |
|
Oct 1998 |
|
EP |
|
WO 99 57846 |
|
Nov 1999 |
|
WO |
|
Other References
Bellare, M., et al., "Keying Hash Functions For Message
Authentication", Proceedings of the Annual International Cryptology
Conference (CRYPTO), DE, Berlin, Springer, vol. Conf. 16, 1996, pp.
1-15, XP000626584. cited by other.
|
Primary Examiner: Abrishamkar; Kaveh
Attorney, Agent or Firm: Oblon, Spivak, McClelland, Maier
& Neustadt, L.L.P.
Claims
The invention claimed is:
1. A method for the authentication of data communicated from an
originator computer device to a destination computer device,
comprising: generating, at the originator computer device, a random
bit array; generating, at the originator computer device, a digest
of data using a private key according to a keyed-hashing technique,
said data including said random bit array and temporal validity
information defined at the originator computer device and
representing the temporal validity of the data; transmitting the
data together with the digest from the originator computer device
to the destination computer device; searching in a key table for a
key that is identical to a current login key random bit array and
terminating a connection between the originator computer device and
the destination computer device in response to finding a key
identical to the current login key random bit array in the key
table; storing the random bit array of the current login key in the
key table until the current login key expires; verifying, at the
destination computer device, an authenticity of the data received
at the destination computer device based on the digest received at
the destination computer device and the private key at the
destination computer device; and verifying, at the destination
computer device, a temporal validity of the data received at the
destination computer device based on the temporal validity
information included in the data received at the destination
computer device, wherein the private key used for generating the
digest of data at the originator computer device and for verifying
the authenticity of the data received at the destination computer
device is shared by the originator computer device and the
destination computer device.
2. The method according to claim 1, wherein the data further
comprises random data which are unique for a time span defined by
the temporal validity information.
3. A distributed system comprising: an originator computer device;
and a destination computer device, wherein the originator computer
device is configured to generate a random bit array, generate a
digest of data using a private key according to a keyed-hashing
technique, said data including said random bit array and temporal
validity information defined by the originator computer device and
representing the temporal validity of the data, and transmit the
data together with the digest of the hash function from the
originator computer device to the destination computer device, and
the destination computer device is configured to search in a key
table for a key that is identical to a current login key random bit
array and terminate a connection between the originator computer
device and the destination computer device in response to finding a
key identical to the current login key random bit array in the key
table, store the random bit array of the current login key in the
key table until the current login key expires, verify an
authenticity of the data received at the destination computer
device based on the digest received at the destination computer
device and the private key at the destination computer device, and
verify a temporal validity of the data received at the destination
computer device based on the temporal validity information included
in the data received at the destination computer device, wherein
the private key used for generating the digest of data at the
originator computer device and for verifying the authenticity of
the data received at the destination computer device is shared by
the originator computer device and the destination computer
device.
4. The distributed system according to claim 3, wherein the data
further comprises random data which are unique for a time span
defined by the temporal validity information.
Description
CROSS-REFERENCE TO RELATED APPLICATION
The present continuation application claims the benefit of priority
under 35 U.S.C. .sctn.120 to application Ser. No. 9/728,800, filed
Dec. 1, 2000, and under 35 U.S.C. .sctn.119 from European
application No. 99 124 150.6, filed on Dec. 2, 1999, the entire
contents of both are hereby incorporated herein by reference.
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates to a method for the authentication of
data communicated from an originator to a destination, to a method
for the authenticated transmission of messages, to a software
program product capable of implementing such a method, to a
distributed system for communicating authenticated data from an
originator to a destination as well as to a distributed system for
the authenticated transmission of messages.
2. Description of the Related Art
Generally the present invention relates to the field of secure
communication setup systems and methods which allow the secure
communication setup between two communication parties, an
originator and a destination. In an authenticated (but not secret)
two party communication setup the communication partners and the
messages exchange must be authenticated meaning that the
communicating parties can verify that the received messages have
not been altered as well as that the sender and receiver are
authentic.
Generally there are the following four important aspects of secure
communication setup between two communicating parties: Assurance
that the originating communication partner is authorized to
establish the connection (source is authentic), assurance that the
receiving communication partner is authorized (destination is
authentic), assurance that the received message was sent by the
originating communication partner, and assurance that the sent and
received message has not been altered.
From the state of the art it is known to use keyed-hashing message
authentication techniques. General background information on
message authentication codes (MAC) and cryptographic (one-way)
hashing can be found for example in Schneyer, Bruce "Applied
Cryptography", Edison-Wessley 1996.
Keyed-hashing for message authentication (HMAC) is a mechanism for
message authentication using cryptographic hash functions. HMAC can
be used with any iterative cryptographic hash function, e.g. MD5,
SH-1 in combination with a secret (private) shared key. The
cryptographic strength of HMAC depends on the properties of the
underlying hash function. HMAC uses a secret key for calculation
and verification of the message authentication values.
Further information on HMAC can be found for example in Bellare et
al. "Keying hash functions for message authentication", Proceedings
of Crpyto-96, LNCS 1109, pages 1 to 15.
The very first and initial communication step in communication
setup (e. g. the login procedure) is susceptible to copy or replay
attacks which send a copy of communication setup (e.g. a user name
and password recorded from a login procedure) to the communication
partner. This problem is usually solved with additional knowledge
about the communication partner at the other side and/or using
large random session keys or transaction keys (usually taken from a
transaction hearing).
It is the object of the present invention to provide for a
technique reducing the risk of copy or replay attacks particularly
in the first step of a communication setup in a more efficient
way.
This object is achieved by means of the features of the independent
claims. The dependent claims develop further the central idea of
the invention.
According to the present invention, a method for the authentication
of data communicated from an originator to a destination is
provided. A keyed-hashing technique is used according to which data
to be authenticated is concatenated with a private key and then
processed with a cryptographic hash function. The data are then
transmitted together with the digest of the hash function from the
originator to the destination. The data comprise temporal validity
information representing the limited temporal validity of the
data.
The temporal validity information can be defined by the
originator.
The data can comprise random data which are unique for a time span
defined by the temporal validity information.
The data can be a login key for a communication setup and/or a
message.
According to another aspect of the present invention a method for
the authenticated transmission of messages is provided. A login key
is at first generated by a keyed-hashing method on the basis of
random data, temporal validity information and a private key. The
login key is transmitted from an originator to a destination. The
authenticity and the temporal validity of the login key is verified
on the basis of the keyed-hashing digest on the destination
side.
In case the verification of the authenticity and the temporal
validity of the login key is positive, further acknowledgement
steps can be effected. An acknowledgement key can be generated by a
keyed-hashing method on the basis of second random data and the
private key. The acknowledgement key is transmitted from the
destination to the originator. The acknowledgement key is then
verified by the originator.
The acknowledgement key can furthermore comprise a time stamp and
when verifying the acknowledgement key it can be checked on the
basis of the time stamp and the temporal validity information
whether the acknowledgement key is still valid.
The method can furthermore comprise message transmission steps in
case the verification of the acknowledgement key is positive. The
second random data of the acknowledgement key are extracted. A
message is generated by a key hashing method on the basis of the
second random data, message data and the private key. The message
is then transmitted from the originator to the destination and the
message is verified by the destination.
The message can furthermore comprise a time stamp and when
verifying the message it is checked on the basis of the time stamp
and the temporal validity information whether the message is still
valid.
According to a still other aspect of the present invention a
software program product is provided implementing, when loaded into
a computing device of a distributed system, a method according to
anyone of the preceding claims.
According to a still other aspect of the present invention a
distributed system for communicating authenticated data from an
originator to a destination is provided. The system is designed for
a keyed-hashing technique according to which data to be
authenticated is concatenated with a private key and then processed
with a cryptographic (one-way) hash function. The data are then
transmitted together with the digest of the hash function from the
originator to the destination. The data thereby comprised temporal
validity information representing the temporal validity of the
data.
The originator can be designed to define the temporal (limited)
validity information.
The data can comprise random data which are unique for a time span
defined by the temporal validity information.
The data can be a login key for a communication setup and/or a
message.
According to a still other aspect of the present invention a
distributed system for the authenticated transmission of messages
is provided. The distributed system comprises an originator
designed to generate a login key by a keyed-hashing method on the
basis of random data, temporal validity information and a private
key. Furthermore, a network for transmitting the login key from the
originator to a destination is provided. The destination is
designed to verify the authenticity and the temporal validity of
the login key on the basis of the keyed-hashing digest.
The destination can be designed to generate an acknowledgement key
by a keyed-hashing method on the basis of second random data and
the private key and to transmit the acknowledgement key to the
originator in case the verification of the authenticity and the
temporal validity of the login key is positive. The originator is
designed to verify the acknowledgement key.
The acknowledgement key can furthermore comprise a time stamp and
when verifying the acknowledgement key the originator checks on the
basis of the time stamp and the temporal validity information
whether the acknowledgement key is still valid.
The originator can be designed to extract the second random data
from the acknowledgement key in case the verification of the
acknowledgement key is positive, to generate the message by a
keyed-hashing method on the basis of the second random data,
message data and the private key and to transmit the message to the
destination.
The destination is designed to verify the message.
The message can furthermore comprise time stamp and when verifying
the message, the destination checks on the basis of the time stamp
and the temporal validity information whether the message is
(still) valid.
Further features, advantages and objects of the present invention
will become evident for the man skilled in the art when reading the
following description of an embodiment taken in conjunction with
the figures of the enclosed drawings.
FIG. 1 shows hand shake and information flow between two
communication partners with a time synchronized communication setup
by keyed-hashing message authentication (TSCS), FIG. 2 shows the
TSCS login key and acknowledgement key, and FIG. 3 shows the
internal structure of a TSCS login key.
According to the time synchronized communication setup by
keyed-hashing message authentication (TSCS) almost all setup keys
are unique by using a secure random number generator. The setup key
is only valid within a given time interval that is dynamically
defined by the communication originator. The information sender and
receiver authenticate each other. Only if both partners are
authenticated, the information will be accepted by the
communication partner. After the time interval is exceeded the
setup key is invalid and cannot be reused again. Within the time
interval the setup key can be reused. This feature is realized
without storing of login keys.
The communication partners share only a single private (secret) key
(of arbitrary length) which can be exchanged periodically using
known secure protocols (e.g. a public key encryption method). The
TSCS communication setup protocol is inherently robust against copy
or replay attacks. As mentioned above, TSCS relies on the
keyed-hashing for message authentication code (HMAC). It is known
from the prior art that HMAC is hard to break even if the
underlying secure hash function (e.g. SHA-1 or MD-5) has some
weakness such as predictable collisions.
FIG. 1 shows handshake and information flow between two
communicating partners with the Time Synchronized Communication
Setup by Keyed-Hashing Message Authentication (TSCS).
In phase 1 the information originator generates a TSCS login key
and sends the login key to the receiver. As shown below a TSCS
login key consists of a (secure) random bit array, a unified system
time, a temporal validity field and its authentication key. If the
random bit array is large the chance of generation of generating
two identical random arrays is very small. The receiver receives
the login key and checks its authentication key. Because of the
originator and the receiver share the same private key, the login
keys digest differs if the login key has been altered (in this case
further communication is denied). If the key is valid, the receiver
checks its temporal validity as described in the validity
field.
In phase 2 the receiver generates a TSCS acknowledgement key and
sends it to the receiver: The acknowledgement key consists of a new
random bit array (independent from the originator) and the unified
system time of the receiver.
In phase 3 the originator checks the acknowledgement key (i.e. the
digest and temporal validity), takes the random bit field of the
acknowledgement key and merges it with the message data which is
intended to be sent. The data (consisting of the message and the
random field) is signed and sent to the receiver.
Then the receiver checks in phase 4 the message digest and the
identity of random bit field (from the message) and the previously
generated random bit array of the acknowledgement key. If the
message digest is valid and the bit arrays are identical, the
message has mot been altered AND was generated as a result of the
previous exchange of login and acknowledgement keys. The receiver
sends then an acknowledgement to the communication originator.
FIG. 2 shows the TSCS login and acknowledgement key. The login key
is created and signed by the communication originator. The
acknowledgement key is returned and signed by the receiver. The
transmitted signature is not necessarily the complete keyed-hashing
message authentication code (HMAC) with its fall digest length. For
the login and acknowledgement keys it may be meaningful for
security and key length to compress the digest to limit its
length.
FIG. 3 shows the internal structure of a TSCS login key. The HMAC
key digest may be compressed to reduce key length and to prevent
the private key K from key break attacks if the signed message is
short (here 265 bit). A compression to 80 bit digest length (by a
state machine) is appreciated for short message lengths.
The handshake between the two communicating parties consists of
four phases. In the following the procedure according to the
present invention will be explained in detail. PHASE 1:
Communication originator login
a) Generate a TSCS login key
b) generate of a secure random bit array
c) append the unified time (UT) field
d) append the temporal validity field
e) generate the Keyed-Hashing Message Authentication Code (HMAC)
using private key K
f) append the HMAC (or a subset of) to the login key
g) transmit the login key to the receiver, PHASE 2:
Receiver acknowledgement
a) [OPTION 1] search the key table for a key that is identical to
the current login key random bit field
b) [OPTION 1] if a duplicated key was found in the key table,
terminate connection and exit.
c) [OPTION 1] store the random bit array of the login key in the
key table until key expires
d) verification of the login key authenticity and validity
e) check the login key signature (the digest)
f) calculate own HMAC using private key K
g) compare own HMAC with login key digest
h) check the login key temporal validity
i) calculate the difference between login key universal time and
current time (of the receiver).
j) check if time difference (the absolute value) is less then the
temporal validity of the login key
k) generate the acknowledgement key
l) generate secure random bit array (the session key)
m) store session key.
n) append the unified time (UT) field
o) generate the Keyed-Hashing Message Authentication Code (HMAC)
using private key K
p) append the HMAC (or a subset of) to the acknowledgement key
q) transmit acknowledgement key to communication originator PHASE
3:
Message transmission
a) verification of the acknowledgement key authenticity and
validity
b) check the acknowledgement key signature (the digest)
c) calculate own HMAC using private key K
d) compare own HMAC with acknowledgement key digest
e) check the acknowledgement key temporal validity
f) calculate the difference between acknowledgement key universal
time and current time (of the originator).
g) check if time difference (absolute value) is less then the
temporal validity of the acknowledgement key
h) extract the random bit field from acknowledgement key
i) append or merge the random field (the session key) with the
message data
j) [OPTION 2] append universal time (of the originator) to the
message
k) sign the message data and session key (and optionally universal
time), i.e. calculate HMAC of message data and session key using
private key K
l) append HMAC (or a subset of) to the message data and session
key
m) transmit the message, i.e. transmit the message data, session
key and HMAC to the receiver PHASE 4:
Message verification
a) verification of the message authenticity (and optionally
validity)
b) compare the session key of the message with the previously
stored session key
c) check the message signature (the digest)
d) calculate own HMAC using private key K
e) compare own HMAC with message digest
f) [OPTION 2] check the message temporal validity
g) [OPTION 2] calculate the difference between message universal
time and current time (of the receiver) (optionally)
h) [OPTION 2] check if time difference (absolute value) is less
then the temporal validity of the acknowledgement key
(optionally)
i) return an acknowledgement to the communication originator
OPTION 1 is designed to eliminate so-called reply attacks (multiple
use of the TSCS login key) even if the time span according to the
appended temporal validity field is not yet expired. Note that said
time span can be user defined between some nanoseconds and some
minutes. Particularly in an Internet environment the time span will
be chosen to be very long, wherein in direct connected networks it
will be chosen to be quite short.
OPTION 2 gives the possibility to define a further time span for
the temporal validity of the message itself.
As explained the invention relates to authenticated transmission of
messages in distributed messaging and (multimedia)
telecommunication systems. Time synchronized message and
communication authentication can be also applied to a common
message based communication between two communication partners.
With minimal extension the TSCS can be also applied to 1-to-N
communication like broadcast. The present invention relates to
message oriented communication. Logically, message oriented
communication means here that in an initial step the communication
is established, then the message is send and in a third step an
(optional) acknowledgement is returned by the receiving party.
Message oriented communication is not effective for applications
that require continuous (uni- or bi-directional) data transmission
such as in real-time voice or video transmissions.
A technique for realizing secure authentication of communication
setup and message transmission between two communicating parties is
described. Time Synchronized Communication Setup by Keyed-Hashing
Message Authentication (TSCS) provides the ability of
Authentication of communicating partners. Authentication of
transmitted information. Communicating partners share only a single
private key that can be periodically changed (between the partners)
by using state-of-the-art public key encryption for key
transmission. Limited temporal validity (from nanoseconds to days)
of session keys that enhances communication security and limits the
chance and the effects of copy or replay attacks, Unsolicited
message data sent from replay attacks will be (almost) detected,
When secure random keys are stored during their time of validity
(from nanoseconds to days), replay attacks during the initial
communication setup phase (which does not harm message integrity)
are (almost) impossible, Formerly exchanged session keys can
(almost) never be reused again after a defined time interval
(defined by the communication originator). This key property is
realized without the storage of session keys. Limitation (inherent
in the apparatus) of the temporal validity of transmitted
information.
Obviously, numerous modifications and variations of the present
invention are possible in light of the above teachings. It is
therefore to be understood that within the scope of the appended
claims, the invention may be practiced otherwise than as
specifically described herein.
* * * * *